Topic starter
06/07/2026 9:46 am
TL;DR: Salesforce connected apps turn OAuth, SAML, and OpenID Connect into non-human identity pathways that can expand access far beyond the original business intent, especially when multiple integrations share one user context, according to Token Security. The governance problem is not connectivity itself, but the assumption that one identity can safely represent many apps without creating privilege spillover.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Salesforce Connected Apps: Navigating NHI Security Risks and Best Practices”.
Key questions
Q: What breaks when Salesforce connected apps share one integration user?
A: The shared account becomes a privilege aggregation point, so each connected app inherits the full permission stack granted to that user.
Q: When should teams prioritise dedicated integration users over shared accounts?
A: They should prioritise dedicated integration users whenever multiple connected apps touch different data sets, business functions or export paths.
Q: How do security teams know if a connected app is overprivileged?
A: Look for apps that can reach more objects, environments, or actions than their business function requires, especially if they use admin users or broad OAuth scopes.
Practitioner guidance
- Define a dedicated identity for each integration Create one Salesforce integration user per connected app so that access, logging and offboarding stay attached to a single business purpose.
- Reset the baseline profile to minimum access Review each integration user’s profile first, then remove any baseline permission that is not required by that one app’s function.
- Audit additive permissions for spillover Compare the permissions on each shared or reused account against the actual tasks of every connected app to identify cross-app privilege leakage.
Bottom line: Salesforce connected apps can turn ordinary delegation into NHI sprawl when one user context is reused across multiple integrations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:03 am
Salesforce connected apps are non-human identities in human clothing: The article shows that OAuth-connected apps act under the authorising user’s privileges, which means the real security object is the delegated identity, not the application branding. That matters because ownership models built only around business applications miss the access and audit consequences of delegation. Practitioners should govern connected apps as NHI assets with explicit scope, ownership and review.
A question worth separating out:
Q: Who is accountable when a connected app exposes Salesforce data?
A: Accountability sits with the organisation that allowed the connection, because the business owns the risk created by granting access to sensitive systems. Security, IAM, and application owners should share responsibility for approval, monitoring, and revocation. Governance must cover inventory, permission review, and exception handling so third-party access does not become unmanaged.
👉 Read our full editorial: Salesforce connected apps expose NHI governance gaps in access control